The objective of this section is to understand the very simple
but extremely effective method of reducing default privileges.
This will help contain malware or an attacker
by reducing the privileges that they run under.
Most attackers have the level of privilege of the logged in user
or the privilege of the process running the application that was exploited.
This means if you're logged in with an admin privilege,
so effectively got on the operating system,
the malware will have the same level of privileges
if they exploit the system
via you or a process that you're running or application that you're running.
If you are logged in with restricted privileges,
the malware is also restricted.
Restricting privileges is a standard approach
in Linux and UNIX type operating systems
where the admin or root account is rarely used.
To access those accounts, or to access root,
you use su or sudo command
and stay with the standard user most of the time.
But this is not the case in Windows.
Administrative privileges is the default.
You simply need to change your account in Windows
to be a standard user
and use an admin account just for when you need it.
This has surprisingly little administrative burden
as you will be prompted for the admin privileges if and when you need them,
which is mostly when you're installing applications.
This is a nice, easy win to lock down any attacker or attack,
you have to train yourself
not to blindly enter the admin password when requested,
and question the reason you're being prompted
for the admin username and password,
and make sure that it is actually genuine.
If an attacker has reduced privileges,
it forces the attacker
to attempt to try to do privilege escalation techniques,
which exploits aren't always available or possible
or written into the malware that is doing the attack,
so it effectively reduces the attack surface.
According to Avetco's annual Microsoft vulnerability report,
removing user admin privileges in Windows
would result in 86% of all Windows threats being stopped,
which is a shocking statistic.
That shows you how important it is
not to run as an administrator but run as a standard user in Windows.
And in fact it's important in all operating systems,
but most important in Windows.